Table of contents
Highlights
AI agents that take autonomous actions require security controls fundamentally different from those designed for traditional software.
Prompt injection, tool misuse, and memory poisoning represent distinct threat categories unique to AI agent security.
Least-privilege access combined with scoped action boundaries may significantly reduce the blast radius of agent failures.
Enterprise governance frameworks like NIST AI RMF provide a structured foundation for managing agentic AI risk.
Moveworks enables AI agent security at the platform level through built-in controls, observability, and FedRAMP Moderate authorization.
The way workers complete computer-based tasks is rapidly changing thanks to the proliferation of AI agents. So far, public discussion has centered on agentic AI’s capabilities and potential to change the workplace and the job market. But as enterprises implement these tools, it’s critical to understand the practicalities of deploying them at scale.
Previously, workplace AI was passive: Employers had to direct large language models (LLMs) and basic automation tools each step of the way. Agentic AI tools, however, are capable of executing entire workflows with limited human intervention.
As agentic AI is incorporated into more enterprise workflows, sound security and governance practices are more important than ever. Here’s what you should know about the updated threat landscape, AI-appropriate security measures, and how to create your own AI risk management framework.
Why traditional security models fall short for AI agents
Today’s standard security models are built around assumptions made about human behavior — but those assumptions don’t hold up when it comes to AI agents.
Once you equip LLMs with the ability to reason and make decisions as AI agents do, you have a whole new set of security needs.
Humans approach tasks deliberately, following set routines to reach their desired outcomes. But AI agents take a probabilistic approach to problem solving. Humans tend to have static access patterns that make it easy to spot unauthorized logins. AI agents chain tools in unexpected ways, making it harder for traditional anomaly detection to catch suspicious activity.
Role-based access control (RBAC) can keep employees from misusing company systems. But AI agents often have permissions that let them make API calls or mass-edit files without anyone knowing the potential consequences. Even with RBAC in place, a compromised AI agent can cause damage at a scale no human bad actor could match.
What makes AI agents different from traditional AI software
AI agents’ dynamic and autonomous nature creates different security impacts than other apps, platforms, and programs.
Pre-LLM AI technology is largely deterministic, meaning users learn which inputs deliver desired results. AI agents are much more flexible because natural language understanding (NLU) lets them accept almost any input. However, they can only respond to these varied inputs because they use probabilistic logic to handle unknowns.
This means their behavior is harder to predict, and harder to guard against potential security vulnerabilities.
And, because agents maintain context between operations, previous instructions carry forward with each new task. This capability supports complex multi-step workflow automation, but can also compound risk. While traditional software resets between operations, agents can carry forward context that could compromise their integrity.
The AI agent threat landscape
AI agents introduce new attack surfaces that IT teams need to defend. Because they act autonomously and operate in ways many employees aren’t trained to trace or understand, bad actors see them as attractive targets. Let’s take a closer look at a few common attack surfaces affecting AI agents.
Prompt injection and goal hijacking
Because AI agents are expected to work autonomously, bad actors can redirect their aims or tactics mid-operation without employees ever noticing.
Indirect prompt injection attacks override agent programming by hiding instructions within external data sources. An employee won't see the prompt, and the agent won't know not to trust it.
Attackers often use prompt injection in goal manipulation or hijacking attacks: the injected prompt tells your agent to change tactics or shift its final goals.
For example, consider an AI agent designed to read and synthesize various online sources for your employees. The agent could be hit with a prompt injection attack that instructs it to make a large purchase before completing its actual task. . . and the employee would never know the agent was compromised.
Tool misuse and privilege escalation
Agentic AI is powerful because it can interact with other tools in your tech stack. Bad actors want that power for themselves. Even when AI agents' permission structures look safe, their ability to chain tools together or prompt other AI agents could give them deeper access than intended.
A compromised AI agent may escalate privileges to bypass permission constraints. Enterprises aren’t knowingly giving coding agents write access to their production environment. But without the right guardrails, an agent instructed to inject malicious code could work backward through your DevOps pipeline to find secret credentials in your Git repository, swap a poisoned dependency for a trusted one, or give a Docker container root access by changing user settings.
Memory poisoning and data exfiltration
Because AI systems remember past sessions and adjust actions based on that context, bad actors may be able to compromise them with false memories. If someone poisons an AI system’s memory, it could change what an agent trusts and override previous safeguards.
Consider a client risk assessment agent that’s poisoned with a false memory instructing it to email backups to an external contact. Each time a new client submits information, the agent would pass it on without verification, since the user previously told it to do so.
The attacker has just created a data exfiltration hack that will persist until someone audits the agent’s actions or completely resets its programming to overwrite its long-term memory.
Governance frameworks for enterprise AI agents
Unlike other software, agentic AI operates across multiple systems and can make autonomous decisions that affect business processes and data, so structured guardrails are a must — not an optional add-on. Organizations that map agent capabilities to compliance standards from the outset can accelerate adoption without sacrificing oversight.
Frameworks like the NIST AI Risk Management Framework can give you the scaffolding you need to build a risk management program that fits your enterprise’s goals and needs. Start by identifying which of your existing compliance structures apply to agentic AI, then build agent governance to fit those requirements.
This approach lets you deploy agents confidently: Your employees can experiment with agentic tools within a framework that maintains the oversight your industry expects.
How to evaluate AI agent security for your organization
Each company has its own standards for AI agents based on factors like industry compliance requirements, data sensitivity, and overall risk tolerance. You should be able to spell out your standards based on your agentic AI governance framework.
Once you're clear on your company's standards, you can compare agentic AI platforms based on whether they support the controls your governance and security framework call for.
Pro tip: Prioritize vendor transparency around agent decision-making and tool access. The more you know about how a platform’s agents work up front, the easier it is to build and implement the necessary controls and oversight.
Building enterprise trust in autonomous AI
Trust is essential to getting the most out of agentic AI, and trust starts with investment in agent governance, observability, and least privilege. Enterprise teams that build safeguards for AI agents have the ability to move faster, experiment more, and use AI tools to their full potential — and to do it safely at scale.
With Moveworks, security is designed to minimize the tradeoff between speed and safety. Moveworks' architecture treats security as a design principle. The Reasoning Engine operates within scoped action boundaries enforced at the infrastructure level, with detailed audit trails for compliance.
Learn more about how Moveworks’ enterprise-grade AI security and data privacy can support faster, more confident agent adoption.
Frequently Asked Questions
AI agents introduce risks that go beyond traditional software vulnerabilities, including prompt injection, tool misuse, privilege escalation, and memory poisoning. Because agents take autonomous actions rather than simply returning text, a single compromised step can trigger real-world consequences across connected systems. Organizations should assess these risks relative to the scope of actions they delegate to agents.
Securing AI agents requires a layered approach that combines least-privilege access controls, scoped action boundaries, and human-in-the-loop approval for high-risk operations. Full observability into agent reasoning and tool invocations is equally important for ongoing risk management. Platforms like Moveworks enforce these controls at the infrastructure level rather than relying on post-deployment patches.
The OWASP framework for agentic AI identifies key threats specific to autonomous agents, including prompt injection, excessive tool access, and inadequate output validation. It provides a structured way to evaluate and prioritize the security gaps that matter most in agent deployments. Enterprise teams may find it useful as a baseline for vendor evaluation and internal risk assessment.
Well-designed AI agents operate under least-privilege principles, meaning they receive only the permissions necessary for a specific task. Action boundaries further restrict which tools an agent can invoke and under what conditions, reducing the blast radius of any single failure. Human approval gates add another layer for sensitive operations like data modification or financial transactions.
Several established frameworks apply to agentic AI, including the NIST AI Risk Management Framework and FedRAMP for government deployments. These frameworks help organizations map agent capabilities to existing compliance requirements and accountability structures. Adopting a recognized framework may accelerate enterprise adoption while maintaining the oversight regulators expect.
